ABSTRACT 

Principal Component Analysis (PCA) is used to model a process, and 
clustering techniques are used to group excursions representative of events based on 
sensor residuals of the PCA model. The PCA model is trained on normal data, and 
then run on historical data that includes both normal data, and data that contains 
events. Bad actor data for the events is identified by excursions in Q (residual error) 
and T2 (unusual variance) statistics from the normal model, resulting in a temporal 
sequence of bad actor vectors. Clusters of bad actor patterns that resemble one 
another are formed and then associated with events. 
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